I am building haproxy from source.
For some load balancers that I used to manage, I also built openssl from
source, statically linked, and compiled haproxy against that, because
the openssl included with the OS (CentOS 6 if I recall correctly) was
ANCIENT. I don't know how to get haproxy to use the alternate openssl
at runtime, which is why I compiled openssl to be linked statically.
For my own servers, I am running Ubuntu 20, which has a reasonably
current openssl version already included.
I know that openssl on Ubuntu is compiled with support for Intel's
AES-NI instructions for accelerating crypto. That can be seen by
running these two commands on a system with a proper CPU and comparing
the reported speeds:
openssl speed -elapsed aes-128-cbc
openssl speed -elapsed -evp aes-128-cbc
But the fact that it requires the -evp arg on the commandline to get the
acceleration makes me wonder if maybe openssl 1.1.1 has CPU acceleration
turned off by default, requiring an explicit enable to use it.
My question is ... will haproxy use the CPU crypto acceleration with
stock Ubuntu openssl if the
hardware supports it? I would have tested it if I could figure out how.
Thanks,
Shawn
